Announcement

Collapse
No announcement yet.

PuTTY vulnerability

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • PuTTY vulnerability

    Versions of PuTTY and pterm between 0.54 and 0.65 inclusive have a potentially memory-corrupting integer overflow in the handling of the ECH (erase characters) control sequence in the terminal emulator.

    To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server you're connecting to. For instance, an attacker on a multi-user machine that you connect to could trick you into running cat on a file they control containing a malicious escape sequence. (Unix write(1) is not a vector for this, if implemented correctly.)

    Only PuTTY, PuTTYtel, and pterm are affected; other PuTTY tools do not include the terminal emulator, so cannot be exploited this way.

    http://www.chiark.greenend.org.uk/~s...-overflow.html
    Pretty niche vuln and thus unlikely to post any threat to most people, but probably worth upgrading none-the-less.

  • #2
    doh!!
    "Those able to see beyond the shadows and lies of their culture will never be understood, let alone believed, by the masses."
    Plato

    Comment


    • #3
      Oh it's been a long time since I used Putty. I can barely remember what I used to use it for lol.
      My local hospital has a sign which reads "This way for accidents and emergencies." Haven't people in hospital got enough to worry about without looking for further misfortune?


      Comment


      • #4
        Perhaps it's time for an upgrade...

        i5 2500k | 16GB RAM | Sapphire R9 290 Tri-X OC | 256GB + 240GB SSDs | 1TB + 3TB HDDs | Define R5 Black | Dell 27" 1440p 60Hz + BenQ 24" 1080p 144Hz

        Comment


        • #5
          0.65 here, still not updated xD
          "Those able to see beyond the shadows and lies of their culture will never be understood, let alone believed, by the masses."
          Plato

          Comment


          • #6
            We use this in work and it does its job well enough, I dont recall what version we use though.
            i7 3770k - MSI Z77 Mpower - 16GB Avexir Mpower 2400Mhz - 500GB Samsung 840 EVO - EVGA GTX 980 SC - 1200W CM Gold - Custom Watercooling Loop - Corsair Air 540 - Steelseries 6Gv2 - Logitech MX 518 - Asus PB287Q - Creative T20




            Comment


            • #7
              Used putty for years, and before that teraterm. As CF said, not really an issue for most since the server needs to have been compromised first, but it doesn't hurt to be aware of the issue and it only takes a moment to grab the latest version .

              Comment


              • #8
                0.60 at home... at work I've moved on to Cygwin
                --
                Fractal R4 (shhh!) 3570k, z77x-d3h, 16gb, R9-270X, 240gb SSD, 2tb mirror w/ 60gb cache drive

                Comment


                • #9
                  Originally posted by Spaceboy View Post
                  0.60 at home... at work I've moved on to Cygwin
                  Cygwin is such a pain in the posterior though. ssh-agent randomly crashes, no proper user management nor command elevation, can't edit hosts file directly, vi bash editing doesn't perform correctly, tab auto-completes add that annoying .EXE file extension, package management is a complete hack, I could go on. Horrible, awful, crap. You're better off just running a Linux VM.

                  However on the topic of this PuTTY vulnerability, it does also affect one (or more) of Cygwin's terminal emulators as that's based on PuTTY's term.

                  Comment


                  • #10
                    Originally posted by cold fusion View Post
                    You're better off just running a Linux VM.
                    This is what I generally do nowadays, yeah.

                    Comment


                    • #11
                      Does me for ssh access, scp and vi...all I use it for without the need for a vm.
                      I have Linux vms at my disposal when needed,but as a replacement for putty I can't fault it
                      --
                      Fractal R4 (shhh!) 3570k, z77x-d3h, 16gb, R9-270X, 240gb SSD, 2tb mirror w/ 60gb cache drive

                      Comment

                      Working...
                      X